If I have a search result which has a field named "Field1" and It has values like :
This is Word1 now.
This is Word2 now.
This is WordX now.
This is WordZ now.
Below is the look up table for Words.
Field1
Word1
Word2
Word3
Word4
Word5
Word6
How can I search so I get ONLY below results in the output because they contain "Word1" and "Word2"?
This is Word1 now.
This is Word2 now.
I'd say grab the word, look it up and then filter....maybe something like this (not at all tested)
index=whatevs
| rex field=Field1 "^(?:\S+\s+){2}(?<my_word>\S+)"
| lookup word_lookup_table Field1 AS my_word OUTPUT Field1 AS found_word
| where isnotnull(found_word)
And if you didn't want to rex out the word, you could also configure your lookup to wildcard the Field1 field.
https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Addfieldmatchingrulestoyourlookupconfig...